CVE-2026-5445 PUBLISHED

Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable)

Assigner: certcc
Reserved: 02.04.2026 Published: 09.04.2026 Updated: 09.04.2026

An out-of-bounds read vulnerability exists in the DecodeLookupTable function within DicomImageDecoder.cpp. The lookup-table decoding logic used for PALETTE COLOR images does not validate pixel indices against the lookup table size. Crafted images containing indices larger than the palette size cause the decoder to read beyond allocated lookup table memory and expose heap contents in the output image.

Product Status

Vendor Orthanc
Product DICOM Server
Versions
  • affected from 0 to 1.12.10 (incl.)

References

Problem Types

  • CWE-125 Out-of-bounds Read